@scalebun/web 1.0.0 → 1.2.1

package/dist/scalebun-push-sw.js

@@ -1,236 +1,236 @@
-/*!
- * ScaleBun Web Push service worker (scalebun-push-sw.js)
- * ------------------------------------------------------------------------------------------------
- * The HOST serves this file at their own origin (like favicon.ico) — a service worker CANNOT be
- * bundled into the SDK or loaded cross-origin, so ship it as a static asset and register it with
- * `ScaleBun.enablePush({ serviceWorkerUrl: '/scalebun-push-sw.js' })`.
- *
- * Responsibilities (all dependency-free, tiny, versioned):
- *   1. `push`                      — render the notification the backend signed with the VAPID key.
- *   2. `notificationclick`         — focus/open the target URL AND postMessage the page so the SDK
- *                                    can report the open/click (opens → analytics, replay-correlated).
- *   3. `pushsubscriptionchange`    — the browser rotated the subscription: re-subscribe with the same
- *                                    VAPID key and tell the page to re-register the device token.
- *   4. `message` (version ping)    — report WZB_SW_VERSION so ScaleBun.push.check() can tell the host
- *                                    their hand-copied worker has gone stale. Because the host copies
- *                                    this file manually, a worker older than v3 cannot answer at all —
- *                                    check() reports "missing OR pre-v3" rather than guessing.
- *
- * Payload shape (from WebPushProvider.sendToToken):
- *   { title, body, icon?, badge?, image?, actions?, tag?, renotify?, requireInteraction?, silent?,
- *     dir?, lang?, timestamp?, data?: { url?, scalebunCampaignId?, scalebunType?, ... } }
- *
- * ⚠️ VERSION COUPLING: the host COPIES this file to their own origin, so a payload field added here
- * only renders once they re-copy it. `ScaleBun.push.check()` compares WZB_SW_VERSION against the
- * SDK's EXPECTED_SW_VERSION and reports a stale worker — that report is what stops a v4 host
- * silently dropping v5 fields and reading it as "the browser ignored my image".
- */
-'use strict';
-
-var WZB_SW_VERSION = 5; // v5: authorable notification presentation (tag/renotify/requireInteraction/silent/dir/lang/timestamp)
-
-// Take control ASAP so the first push after registration is handled by THIS worker.
-self.addEventListener('install', function () {
-  self.skipWaiting();
-});
-self.addEventListener('activate', function (event) {
-  event.waitUntil(self.clients.claim());
-});
-
-// ── 1. Render the push ──────────────────────────────────────────────────────────────────────────
-// Post a message to every open page (best-effort; a dead client just throws and is skipped).
-// ── Push Doctor beacon (v4) ──────────────────────────────────────────────────────────────────────
-// ONLY fires for a "Test Push" — production pushes carry no scalebunTestRunId and therefore never
-// beacon. When no tab is open, the worker is the only layer that knows a push arrived, so this is the
-// only way the dashboard can show "received".
-//
-// The worker holds NO client key (deliberately — see the pushsubscriptionchange note below), so the
-// test payload carries an absolute beacon URL and a short-lived signed token. The worker POSTs blind:
-// it never learns anything about the tenant, and the token authorises exactly one thing — appending
-// one stage to one run, for a few minutes.
-function scalebunBeacon(data, stage) {
-  if (!data || !data.scalebunTestRunId || !data.scalebunTestBeacon || !data.scalebunTestToken) return;
-  try {
-    fetch(data.scalebunTestBeacon, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      keepalive: true,
-      body: JSON.stringify({ token: data.scalebunTestToken, stage: stage }),
-    }).catch(function () {
-      /* diagnostics must never affect delivery — a failed beacon just shows as "no report" */
-    });
-  } catch (e) {
-    /* ignore */
-  }
-}
-
-function scalebunPostToClients(clientList, message) {
-  for (var i = 0; i < clientList.length; i++) {
-    try {
-      clientList[i].postMessage(message);
-    } catch (e) {
-      /* ignore a dead client */
-    }
-  }
-}
-
-self.addEventListener('push', function (event) {
-  var payload = {};
-  if (event.data) {
-    try {
-      payload = event.data.json();
-    } catch (e) {
-      // Non-JSON payload — fall back to the raw text as the body.
-      try {
-        payload = { body: event.data.text() };
-      } catch (e2) {
-        payload = {};
-      }
-    }
-  }
-
-  var data = payload.data || {};
-  // Campaigns delivered to BOTH push + inbox flag the push so this worker can (a) poke an open page to
-  // pull the new inbox message live and (b) dedupe — suppress the OS banner when a tab is already
-  // focused (the in-app inbox surfaces it, so a second OS notification would double-notify).
-  var isInbox = !!(data.scalebunInbox || data.scalebunType === 'inbox');
-  // A pure sync poke (data-only, no visible content) never renders a banner — it only refreshes.
-  //
-  // ⚠️ v5 — `payload.silent` is NO LONGER a signal here, and removing it was required rather than
-  // tidy. `silent` became an AUTHORABLE presentation field (deliver without sound/vibration), and it
-  // used to also mean "this is an internal sync poke, show nothing". An author ticking Silent would
-  // therefore have suppressed their own notification entirely — a campaign that sends successfully,
-  // reports delivered, and never appears. The internal poke has always carried its own explicit
-  // marker, so that marker is now the only thing that means it.
-  var isSilentSync = data.scalebunType === 'inbox-sync';
-
-  // Report arrival before anything else can go wrong (rendering, dedupe, a closed tab).
-  scalebunBeacon(data, 'received');
-
-  event.waitUntil(
-    self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(function (clientList) {
-      if (isInbox || isSilentSync) {
-        scalebunPostToClients(clientList, { type: 'scalebun-inbox-sync', campaignId: data.scalebunCampaignId || null });
-      }
-
-      // Silent sync poke: pull-only, never show a notification.
-      if (isSilentSync) return undefined;
-
-      // Foreground dedupe: if this push mirrors an inbox message and a tab is focused, let the in-app
-      // inbox handle it instead of stacking an OS banner on top.
-      if (isInbox) {
-        for (var k = 0; k < clientList.length; k++) {
-          if (clientList[k].focused || clientList[k].visibilityState === 'visible') return undefined;
-        }
-      }
-
-      var title = payload.title || 'Notification';
-      var options = {
-        body: payload.body || '',
-        // Keep the full payload on the notification so notificationclick can read data.url etc.
-        data: data,
-        // Collapse repeat sends into one banner. v5: an AUTHORED `payload.tag` wins; `data.tag` stays
-        // supported for older senders, and the inbox campaign tag remains the fallback.
-        tag:
-          payload.tag ||
-          data.tag ||
-          (isInbox && data.scalebunCampaignId ? 'scalebun-inbox-' + data.scalebunCampaignId : undefined),
-      };
-      // v5 — renotify is authorable. It is only legal WITH a tag, so it is derived when unset rather
-      // than sent blindly: a renotify with no tag makes some browsers reject the whole notification.
-      var hasTag = !!options.tag;
-      options.renotify =
-        payload.renotify != null ? !!payload.renotify && hasTag : hasTag && !!(data.tag || (isInbox && data.scalebunCampaignId));
-
-      if (payload.icon) options.icon = payload.icon;
-      if (payload.badge) options.badge = payload.badge;
-      if (payload.image) options.image = payload.image;
-      if (payload.actions) options.actions = payload.actions;
-      // v5 — the rest of what a browser can render. Each is set only when the sender asked, so an
-      // older payload behaves exactly as it did before.
-      if (payload.requireInteraction != null) options.requireInteraction = !!payload.requireInteraction;
-      if (payload.silent != null) options.silent = !!payload.silent;
-      if (payload.dir) options.dir = payload.dir;
-      if (payload.lang) options.lang = payload.lang;
-      if (typeof payload.timestamp === 'number') options.timestamp = payload.timestamp;
-
-      return self.registration.showNotification(title, options);
-    })
-  );
-});
-
-// ── 2. Handle a click → focus/open the target + notify the page ───────────────────────────────────
-self.addEventListener('notificationclick', function (event) {
-  event.notification.close();
-  var data = event.notification.data || {};
-  var url = data.url || data.deepLink || '/';
-  scalebunBeacon(data, 'clicked');
-
-  event.waitUntil(
-    self.clients
-      .matchAll({ type: 'window', includeUncontrolled: true })
-      .then(function (clientList) {
-        // Tell any open page it was opened from a push, so the SDK reports the click. Carries the
-        // campaign id so an inbox-mirrored push marks its inbox copy read (push↔inbox correlation).
-        scalebunPostToClients(clientList, { type: 'scalebun-push-click', data: data, action: event.action || null });
-        // Focus an existing tab on the same origin if we have one; else open a new one.
-        for (var j = 0; j < clientList.length; j++) {
-          var client = clientList[j];
-          if ('focus' in client) {
-            try {
-              if (url && 'navigate' in client) client.navigate(url);
-            } catch (e) {
-              /* cross-origin navigate can throw — ignore, just focus */
-            }
-            return client.focus();
-          }
-        }
-        if (self.clients.openWindow) return self.clients.openWindow(url);
-        return undefined;
-      })
-  );
-});
-
-// ── 4. Version ping (diagnostics) ─────────────────────────────────────────────────────────────────
-// Replies on the MessagePort the page supplied. Deliberately answers ONLY this one message type and
-// leaks nothing else about the worker.
-self.addEventListener('message', function (event) {
-  var data = event.data;
-  if (!data || data.type !== 'scalebun-sw-ping') return;
-  var reply = { type: 'scalebun-sw-pong', version: WZB_SW_VERSION };
-  try {
-    if (event.ports && event.ports[0]) event.ports[0].postMessage(reply);
-    else if (event.source && event.source.postMessage) event.source.postMessage(reply);
-  } catch (e) {
-    /* the asking page went away — nothing to do */
-  }
-});
-
-// ── 3. Re-subscribe on browser-driven rotation ────────────────────────────────────────────────────
-self.addEventListener('pushsubscriptionchange', function (event) {
-  // The old subscription is dead; mint a new one with the same VAPID key (kept on the old sub, or
-  // fall back to the event's newSubscription when the browser supplies it). Then tell the page to
-  // re-register the device token — the page holds the client key, the worker does not.
-  event.waitUntil(
-    (function () {
-      var applicationServerKey =
-        (event.oldSubscription && event.oldSubscription.options && event.oldSubscription.options.applicationServerKey) ||
-        undefined;
-      var resub = event.newSubscription
-        ? Promise.resolve(event.newSubscription)
-        : self.registration.pushManager.subscribe({
-            userVisibleOnly: true,
-            applicationServerKey: applicationServerKey,
-          });
-      return resub
-        .then(function (sub) {
-          return self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(function (clientList) {
-            scalebunPostToClients(clientList, { type: 'scalebun-push-resubscribe', subscription: sub ? sub.toJSON() : null });
-          });
-        })
-        .catch(function () {
-          /* best-effort — a failed re-subscribe simply means the next enablePush() re-registers */
-        });
-    })()
-  );
-});
+/*!
+ * ScaleBun Web Push service worker (scalebun-push-sw.js)
+ * ------------------------------------------------------------------------------------------------
+ * The HOST serves this file at their own origin (like favicon.ico) — a service worker CANNOT be
+ * bundled into the SDK or loaded cross-origin, so ship it as a static asset and register it with
+ * `ScaleBun.enablePush({ serviceWorkerUrl: '/scalebun-push-sw.js' })`.
+ *
+ * Responsibilities (all dependency-free, tiny, versioned):
+ *   1. `push`                      — render the notification the backend signed with the VAPID key.
+ *   2. `notificationclick`         — focus/open the target URL AND postMessage the page so the SDK
+ *                                    can report the open/click (opens → analytics, replay-correlated).
+ *   3. `pushsubscriptionchange`    — the browser rotated the subscription: re-subscribe with the same
+ *                                    VAPID key and tell the page to re-register the device token.
+ *   4. `message` (version ping)    — report WZB_SW_VERSION so ScaleBun.push.check() can tell the host
+ *                                    their hand-copied worker has gone stale. Because the host copies
+ *                                    this file manually, a worker older than v3 cannot answer at all —
+ *                                    check() reports "missing OR pre-v3" rather than guessing.
+ *
+ * Payload shape (from WebPushProvider.sendToToken):
+ *   { title, body, icon?, badge?, image?, actions?, tag?, renotify?, requireInteraction?, silent?,
+ *     dir?, lang?, timestamp?, data?: { url?, scalebunCampaignId?, scalebunType?, ... } }
+ *
+ * ⚠️ VERSION COUPLING: the host COPIES this file to their own origin, so a payload field added here
+ * only renders once they re-copy it. `ScaleBun.push.check()` compares WZB_SW_VERSION against the
+ * SDK's EXPECTED_SW_VERSION and reports a stale worker — that report is what stops a v4 host
+ * silently dropping v5 fields and reading it as "the browser ignored my image".
+ */
+'use strict';
+
+var WZB_SW_VERSION = 5; // v5: authorable notification presentation (tag/renotify/requireInteraction/silent/dir/lang/timestamp)
+
+// Take control ASAP so the first push after registration is handled by THIS worker.
+self.addEventListener('install', function () {
+  self.skipWaiting();
+});
+self.addEventListener('activate', function (event) {
+  event.waitUntil(self.clients.claim());
+});
+
+// ── 1. Render the push ──────────────────────────────────────────────────────────────────────────
+// Post a message to every open page (best-effort; a dead client just throws and is skipped).
+// ── Push Doctor beacon (v4) ──────────────────────────────────────────────────────────────────────
+// ONLY fires for a "Test Push" — production pushes carry no scalebunTestRunId and therefore never
+// beacon. When no tab is open, the worker is the only layer that knows a push arrived, so this is the
+// only way the dashboard can show "received".
+//
+// The worker holds NO client key (deliberately — see the pushsubscriptionchange note below), so the
+// test payload carries an absolute beacon URL and a short-lived signed token. The worker POSTs blind:
+// it never learns anything about the tenant, and the token authorises exactly one thing — appending
+// one stage to one run, for a few minutes.
+function scalebunBeacon(data, stage) {
+  if (!data || !data.scalebunTestRunId || !data.scalebunTestBeacon || !data.scalebunTestToken) return;
+  try {
+    fetch(data.scalebunTestBeacon, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      keepalive: true,
+      body: JSON.stringify({ token: data.scalebunTestToken, stage: stage }),
+    }).catch(function () {
+      /* diagnostics must never affect delivery — a failed beacon just shows as "no report" */
+    });
+  } catch (e) {
+    /* ignore */
+  }
+}
+
+function scalebunPostToClients(clientList, message) {
+  for (var i = 0; i < clientList.length; i++) {
+    try {
+      clientList[i].postMessage(message);
+    } catch (e) {
+      /* ignore a dead client */
+    }
+  }
+}
+
+self.addEventListener('push', function (event) {
+  var payload = {};
+  if (event.data) {
+    try {
+      payload = event.data.json();
+    } catch (e) {
+      // Non-JSON payload — fall back to the raw text as the body.
+      try {
+        payload = { body: event.data.text() };
+      } catch (e2) {
+        payload = {};
+      }
+    }
+  }
+
+  var data = payload.data || {};
+  // Campaigns delivered to BOTH push + inbox flag the push so this worker can (a) poke an open page to
+  // pull the new inbox message live and (b) dedupe — suppress the OS banner when a tab is already
+  // focused (the in-app inbox surfaces it, so a second OS notification would double-notify).
+  var isInbox = !!(data.scalebunInbox || data.scalebunType === 'inbox');
+  // A pure sync poke (data-only, no visible content) never renders a banner — it only refreshes.
+  //
+  // ⚠️ v5 — `payload.silent` is NO LONGER a signal here, and removing it was required rather than
+  // tidy. `silent` became an AUTHORABLE presentation field (deliver without sound/vibration), and it
+  // used to also mean "this is an internal sync poke, show nothing". An author ticking Silent would
+  // therefore have suppressed their own notification entirely — a campaign that sends successfully,
+  // reports delivered, and never appears. The internal poke has always carried its own explicit
+  // marker, so that marker is now the only thing that means it.
+  var isSilentSync = data.scalebunType === 'inbox-sync';
+
+  // Report arrival before anything else can go wrong (rendering, dedupe, a closed tab).
+  scalebunBeacon(data, 'received');
+
+  event.waitUntil(
+    self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(function (clientList) {
+      if (isInbox || isSilentSync) {
+        scalebunPostToClients(clientList, { type: 'scalebun-inbox-sync', campaignId: data.scalebunCampaignId || null });
+      }
+
+      // Silent sync poke: pull-only, never show a notification.
+      if (isSilentSync) return undefined;
+
+      // Foreground dedupe: if this push mirrors an inbox message and a tab is focused, let the in-app
+      // inbox handle it instead of stacking an OS banner on top.
+      if (isInbox) {
+        for (var k = 0; k < clientList.length; k++) {
+          if (clientList[k].focused || clientList[k].visibilityState === 'visible') return undefined;
+        }
+      }
+
+      var title = payload.title || 'Notification';
+      var options = {
+        body: payload.body || '',
+        // Keep the full payload on the notification so notificationclick can read data.url etc.
+        data: data,
+        // Collapse repeat sends into one banner. v5: an AUTHORED `payload.tag` wins; `data.tag` stays
+        // supported for older senders, and the inbox campaign tag remains the fallback.
+        tag:
+          payload.tag ||
+          data.tag ||
+          (isInbox && data.scalebunCampaignId ? 'scalebun-inbox-' + data.scalebunCampaignId : undefined),
+      };
+      // v5 — renotify is authorable. It is only legal WITH a tag, so it is derived when unset rather
+      // than sent blindly: a renotify with no tag makes some browsers reject the whole notification.
+      var hasTag = !!options.tag;
+      options.renotify =
+        payload.renotify != null ? !!payload.renotify && hasTag : hasTag && !!(data.tag || (isInbox && data.scalebunCampaignId));
+
+      if (payload.icon) options.icon = payload.icon;
+      if (payload.badge) options.badge = payload.badge;
+      if (payload.image) options.image = payload.image;
+      if (payload.actions) options.actions = payload.actions;
+      // v5 — the rest of what a browser can render. Each is set only when the sender asked, so an
+      // older payload behaves exactly as it did before.
+      if (payload.requireInteraction != null) options.requireInteraction = !!payload.requireInteraction;
+      if (payload.silent != null) options.silent = !!payload.silent;
+      if (payload.dir) options.dir = payload.dir;
+      if (payload.lang) options.lang = payload.lang;
+      if (typeof payload.timestamp === 'number') options.timestamp = payload.timestamp;
+
+      return self.registration.showNotification(title, options);
+    })
+  );
+});
+
+// ── 2. Handle a click → focus/open the target + notify the page ───────────────────────────────────
+self.addEventListener('notificationclick', function (event) {
+  event.notification.close();
+  var data = event.notification.data || {};
+  var url = data.url || data.deepLink || '/';
+  scalebunBeacon(data, 'clicked');
+
+  event.waitUntil(
+    self.clients
+      .matchAll({ type: 'window', includeUncontrolled: true })
+      .then(function (clientList) {
+        // Tell any open page it was opened from a push, so the SDK reports the click. Carries the
+        // campaign id so an inbox-mirrored push marks its inbox copy read (push↔inbox correlation).
+        scalebunPostToClients(clientList, { type: 'scalebun-push-click', data: data, action: event.action || null });
+        // Focus an existing tab on the same origin if we have one; else open a new one.
+        for (var j = 0; j < clientList.length; j++) {
+          var client = clientList[j];
+          if ('focus' in client) {
+            try {
+              if (url && 'navigate' in client) client.navigate(url);
+            } catch (e) {
+              /* cross-origin navigate can throw — ignore, just focus */
+            }
+            return client.focus();
+          }
+        }
+        if (self.clients.openWindow) return self.clients.openWindow(url);
+        return undefined;
+      })
+  );
+});
+
+// ── 4. Version ping (diagnostics) ─────────────────────────────────────────────────────────────────
+// Replies on the MessagePort the page supplied. Deliberately answers ONLY this one message type and
+// leaks nothing else about the worker.
+self.addEventListener('message', function (event) {
+  var data = event.data;
+  if (!data || data.type !== 'scalebun-sw-ping') return;
+  var reply = { type: 'scalebun-sw-pong', version: WZB_SW_VERSION };
+  try {
+    if (event.ports && event.ports[0]) event.ports[0].postMessage(reply);
+    else if (event.source && event.source.postMessage) event.source.postMessage(reply);
+  } catch (e) {
+    /* the asking page went away — nothing to do */
+  }
+});
+
+// ── 3. Re-subscribe on browser-driven rotation ────────────────────────────────────────────────────
+self.addEventListener('pushsubscriptionchange', function (event) {
+  // The old subscription is dead; mint a new one with the same VAPID key (kept on the old sub, or
+  // fall back to the event's newSubscription when the browser supplies it). Then tell the page to
+  // re-register the device token — the page holds the client key, the worker does not.
+  event.waitUntil(
+    (function () {
+      var applicationServerKey =
+        (event.oldSubscription && event.oldSubscription.options && event.oldSubscription.options.applicationServerKey) ||
+        undefined;
+      var resub = event.newSubscription
+        ? Promise.resolve(event.newSubscription)
+        : self.registration.pushManager.subscribe({
+            userVisibleOnly: true,
+            applicationServerKey: applicationServerKey,
+          });
+      return resub
+        .then(function (sub) {
+          return self.clients.matchAll({ type: 'window', includeUncontrolled: true }).then(function (clientList) {
+            scalebunPostToClients(clientList, { type: 'scalebun-push-resubscribe', subscription: sub ? sub.toJSON() : null });
+          });
+        })
+        .catch(function () {
+          /* best-effort — a failed re-subscribe simply means the next enablePush() re-registers */
+        });
+    })()
+  );
+});